About Approve¶
After this page you can tell an allowance from a blanket approval, recognize the two permissions that can empty a wallet, and decide before you sign whether a request deserves to be granted.
Who this is for¶
Anyone who has clicked through an approval prompt without reading it, or is about to connect a wallet to a new site. If you have never approved anything, read this before your first time.
Before you start¶
- Your wallet, ideally with the approvals or connected-sites screen open.
- No funds are needed, and nothing on this page requires a transaction.
How it works¶
An approval is a standing permission, stored on chain, that lets another address move a specific asset from your wallet without asking you again. You sign once, and the permission survives until you change or revoke it.
Your balance does not move when you approve. That is what makes approvals useful and what makes them dangerous: the transaction that drains the wallet comes later, and it needs nothing from you at that moment.
Allowances¶
A token allowance names one spender and one amount. "This contract may spend up to 100 units of this token" is an allowance. Swaps, liquidity pools, and most DeFi actions are built on it.
Unlimited approvals set the amount to the largest number the contract can store, which wallets display as "unlimited" or "max". The prompt looks the same as a limit of 100, and the spender may take the whole balance at any time, including years later.
Approval for all¶
setApprovalForAll grants an operator control over every token in a collection rather than one token. It is common for NFT marketplaces, and it is the most dangerous single line you can sign: one signature covers everything you own now and everything you receive in that collection later.
Permit signatures¶
A permit is an approval signed off chain, with no transaction and no gas at signing time. The signature is a message, and whoever holds it can submit it to the contract later.
Because nothing is broadcast when you sign, a permit does not appear in your approvals list, and revoking a listed approval does not cancel a permit you already signed. The only reliable defense is to read the message before you sign it.
Why revoking can still cost gas¶
An approval is stored on chain, so removing it is a transaction. A revocation writes a new value, usually zero, and pays gas like any other write. A permit cannot be revoked at all, because nothing exists on chain to revoke until someone submits it.
A revocation also stops only future transfers. It does not return what was already taken, and it does not cancel a transaction the spender has already sent.
What to do¶
- Read the spender. If you cannot say what the address is, do not approve it.
- Prefer a specific amount. Type what you need instead of accepting the unlimited default.
- Refuse approval-for-all unless you are actively listing or trading in a marketplace you chose, and revoke it when you finish.
- Keep a separate wallet for new sites, holding only what you are willing to lose.
- Sign permits only inside a site you opened by typing its address, and only when the message matches the action you requested.
The two permissions that empty a wallet
Approval-for-all on a collection you value, and an unlimited allowance on a token that holds your savings. If a site asks for either in your first session, close it.
Verify it worked¶
After any approval, open the approvals screen and compare the row with what you intended: spender address, token, and amount. If the amount reads unlimited and you meant 100, revoke it and approve again with a limit. How to Check and Cancel Approvals has the full routine.
Troubleshooting¶
| Problem | What to do |
|---|---|
| The approvals screen shows unlimited after I set an amount | Some contracts convert any approval into an unlimited one. Check the screen after signing, not only the prompt. |
| I cannot find a permit in my approvals list | Permits are off chain. Treat the signature itself as the exposure and read the message before signing. |
| Revoking fails with an error | You need BTG for gas, and the approval must be revoked on the network where it exists. |
| A site asks again after every trade | Re-approving per trade is normal for exact-amount approvals, not a sign of a problem. |
| The prompt lists a spender I have never seen | Decline. An approval to an address you cannot identify is the attack, not an inconvenience. |
Next steps¶
- How to Check and Cancel Approvals — find the permissions you already granted.
- DApp Approval Scam — how a drain is staged around one signature.
- Notes on Using Third-Party DApps — what else a connection grants.
Self-check¶
- I can explain the difference between an allowance and approval-for-all.
- I know which of my approvals are unlimited.
- I have not signed a permit message that I did not read.
- Every approval I granted this month names a spender I can identify.